RU2801674C2 - Method and system for user identification by sequence of opened windows of the user interface - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: increased degree of security in the identification of the user is achieved due to the fact that the identifier of the window that is currently open by the user, and the opening time of this window are saved; at each transition to a new window of the user interface, the identifier of this window and the opening time of this window are saved; a predetermined number of sessions of this user is accumulated; the accumulated data are analysed, identifying repeated sequences of visited windows of the user interface (patterns); for each detected pattern, a set of parameters is calculated that characterizes the time elapsed between transitions of a given user from window to interface window; storing a predetermined number of patterns of the given user and, based on the set of parameters calculated for each pattern, at least one classifier is trained to identify the given user by the sequence of visited pages; the trained classifier is used to subsequently confirm the identity of the user during whose work sessions the classifier was trained.

EFFECT: increased degree of security in the identification of the user.

12 cl, 2 dwg

Description

FIELD OF TECHNOLOGY

The present technical solution relates to the field of computer technology, in particular, to a method and system for identifying a user by a sequence of opened windows of the user interface.

BACKGROUND OF THE INVENTION

The task of protecting information from unauthorized access is becoming increasingly important. One of the mechanisms for unauthorized access to other people's funds, actively used by attackers, involves obtaining user credentials (usually a login and password) and then connecting to a protected resource using these credentials. At the same time, regardless of the scenario used to gain access to credentials (use of keyloggers, remote connection to a computer, theft of a mobile device not protected by a password, as well as other methods, as well as various combinations of them), from the point of view of the access control system, the actions of an attacker are indistinguishable from the actions of a legitimate user, under whose credentials the attacker entered the system.

The prior art solutions describing user identification by behavioral analysis: US2017032250A1, publ. 02/02/2017; CN106355450A, publ. 01/25/2017; CN106202482A, publ. 12/07/2016.

In addition, a solution is known from the prior art, RU2649793C1, which describes a method for detecting a remote connection of an intruder to a computer of a legitimate user based on the analysis of time intervals corresponding to mouse cursor movements.

However, prior art solutions have limited functionality. In particular, the solution described in RU2649793C1 is unable to detect an intruder who does not use the remote access program. Many other well-known implementation solutions require a significant amount of human-labeled data.

The proposed method for detecting an attacker who uses someone else's credentials to access a service that provides authorization and access control has no restrictions on the scenario used by the attacker to gain access to a legitimate account and does not require manual markup of the data used for preliminary training of the system.

SUMMARY OF THE INVENTION

The technical problem to be solved by the claimed technical solution is the creation of a computer-implemented method and system for identifying a user by a sequence of user interface windows that are opened, which are described in independent claims. Additional embodiments of the present invention are presented in dependent claims.

The technical result consists in the automatic identification of the user by the sequence of opened user interface windows.

In a preferred embodiment, a computer-implemented method for identifying a user by a sequence of opened user interface windows is claimed, which consists in performing the steps at which, using a computing device:

registering user credentials in the system;

assigning a user ID corresponding to the credentials;

- each window of the user interface opened by the user is assigned an identifier;

- throughout the entire session of the identified user, the sequence of opened windows of the user interface is fixed, while:

• store the identifier of the window that is currently open by the user, and the opening time of this window;

• at each transition to a new window of the user interface, the identifier of this window and the time when it was opened are saved;

- accumulate a predetermined number of sessions of this user;

- analyze the accumulated data, namely, identify repeating sequences of visited windows of the user interface (patterns);

- for each detected pattern, a set of parameters is calculated that characterizes the time elapsed between transitions of a given user from window to window of the user interface;

- storing a given number of patterns of the given user and, based on the set of parameters calculated for each pattern, at least one classifier is trained to identify the given user by the sequence of visited pages;

- the trained at least one classifier is used for subsequent confirmation of the identity of the user, during the sessions of which at least one classifier was trained.

In a particular variant, the user interface windows are web pages.

In another particular variant, from the identified patterns, those are additionally selected, the length and number of which satisfy predetermined criteria, and the parameter sets are calculated only for the selected patterns.

In another particular variant, patterns are selected that have the maximum possible length, and their number should be no more and no less than predetermined values.

In another particular embodiment, patterns containing predefined user interface windows can be assigned a priori weights that are taken into account when selecting or training at least one classifier so that the corresponding patterns have a proportionally greater or lesser influence on the final decision of at least one classifier. .

In another particular variant, the set of parameters calculated for each pattern includes the time elapsed between the given user's transitions from window to window of the user interface, and averaged over all sessions of the given user in which the given pattern occurs.

In another particular variant, the set of parameters calculated for each pattern additionally includes a variance, calculated as a variance of a random variable, for the time intervals between transitions of a given user from window to window of the user interface.

In another particular variant, the set of parameters calculated for each pattern additionally includes the frequency of this pattern in sessions of the given user.

In another particular embodiment, frequency is taken into account when selecting or training at least one classifier so that patterns with higher frequency have a proportionally greater influence on the final decision of at least one classifier.

In another particular variant, the classifier is trained by machine learning.

In another particular variant, the classifier can be implemented as a graph probabilistic model or as an SVM classifier.

The claimed solution is also implemented through a user identification system based on the sequence of visited user interface windows, which contains:

- a block for registering user credentials in the system;

- system clock, made with the possibility of fixing the time

- identification block of the current window of the user interface;

- long-term memory configured to store the database;

- a computing device configured to perform the above described method.

In one of the possible implementation options, the claimed solution is an integral part of the remote banking system.

In another of the possible implementation options, the claimed solution is an integral part of a website that implies user authorization.

In another possible implementation, the user identification system is an integral part of a multiplayer computer game that involves user authorization.

In another of the possible implementation options, the user identification system is an integral part of the software and hardware complex for collaboration, which implies user authorization.

DESCRIPTION OF THE DRAWINGS

The implementation of the invention will be described hereinafter in accordance with the accompanying drawings, which are presented to explain the essence of the invention and in no way limit the scope of the invention. The following drawings are attached to the application:

Fig. 1 illustrates a computer-implemented method for identifying a user from a sequence of user interface windows that open;

Fig. 2 illustrates an example general layout of a computing device.

DETAILED DESCRIPTION OF THE INVENTION

In the following detailed description of the implementation of the invention, numerous implementation details are provided to provide a clear understanding of the present invention. However, one skilled in the art will appreciate how the present invention can be used, both with and without these implementation details. In other cases, well-known methods, procedures and components have not been described in detail so as not to obscure the features of the present invention.

Furthermore, it will be clear from the foregoing that the invention is not limited to the present implementation. Numerous possible modifications, changes, variations and substitutions that retain the spirit and form of the present invention will be apparent to those skilled in the subject area.

The present invention is directed to providing a computer-implemented method and system for identifying a user from a sequence of user interface windows that are opened.

The method will be described using the example of a remote banking system (RBS), however, this example is not limiting. In addition to the RBS system, on the example of which the method will be described, the described method can also be implemented in online computer games, collaboration software, online shopping software, etc.

As shown in FIG. 1, the claimed computer-implemented method for identifying a user by a sequence of opened user interface windows (100) is implemented as follows:

In step (101), the user's credentials are pre-registered in the system. The user credentials are the username and password. It is an important component of network security.

Next, at step (102), a user ID corresponding to the credentials is assigned.

In step (103), each user interface window opened by the user is assigned an identifier.

At step (104), throughout the entire session of the identified user, the sequence of opened windows of the user interface is fixed, while:

• store the identifier of the window that is currently open by the user, and the opening time of this window;

• each time you switch to a new user interface window, save the identifier of this window and the time when it was opened.

At step (106), a predetermined number of sessions of a given user is accumulated, and at step (107), the accumulated data is analyzed, namely, repeated sequences of visited user interface windows (patterns) are identified.

At the same time, at step (108), for each detected pattern, a set of parameters is calculated that characterizes the time elapsed between transitions of a given user from Window to window of the user interface.

After that, at step (109), the given number of patterns of the given user is saved and, based on the set of parameters calculated for each pattern, at least one classifier is trained to identify the given user by the sequence of visited pages.

And at step (110), the trained at least one classifier is used to subsequently confirm the identity of the user, during the sessions of which at least one classifier was trained.

The described method can be implemented in any variant of the authorized remote access service, which implies the presence of several user interface windows or the presence of several work areas in one complex user interface window and various possible ways to switch between them (both windows and zones).

The following technical implementation options are given by way of example and are also non-limiting.

In one variant of the technical implementation, the method can be implemented in the form of an Internet program (script) that operates on the website of the bank providing the RBS service.

In another variant of the technical implementation, the method can be implemented as a “thin client” RBS subsystem, for example, an Internet application that operates on the user’s mobile device: smartphone, mobile phone, etc., and communicates via wireless communication channels with the server bank where the RB system itself is installed and operates.

In yet another embodiment of the technical implementation, the method can be implemented as a subsystem of a hardware-software complex operating in the "cloud" and exchanging data via wireless and wired channels with "thin clients", ATMs and with the bank's processing center.

It is also possible to implement the described method in the form of a distributed hardware and software system located on various Internet servers, for example, for the purpose of load distribution, and serving simultaneously a plurality of RBS channels belonging to different banks.

In yet another embodiment, the method may be implemented as part of a collaboration program or service, where authorized user access is implied (for such programs or services, see https://ru.wikipedia.org/w/index.php?title=%D0 %9F%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D0%BC%D0%BD%D0%BE%D0%B5%D0%BE%D0%B1 %D0%B5%D1%81%D0%BF%D0%B5%D1%87%D0%B5%D0%BD%D0%B8%D0%B5%D1%81%D0%BE%D0%B2%D0 %BC%D0%B5%D1%81%D1%82%D0%BD%D0%BE%D0%B9%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D1%8B&oldid =80620207). In yet another possible embodiment, the described method can be implemented as part of a multiplayer computer game that involves user authorization.

Regardless of the technical implementation of the described method, for its implementation it is necessary to obtain two identifiers: the user identifier and the identifier of the current user interface window.

A user identifier is at least one combination of characters that uniquely characterizes a particular user. For example, the identifier can be a hash function from the phone number of the mobile device from which access to the RBS system is performed. In another case, it may be an agent id (internal client identifier used in the banking system). In another case, this may be a bank card number read by an ATM, or the result of a biometric identification of the cardholder or a hash function from such a result.

It is possible that the identifier is a function of a set of information about the hardware and software configuration of a personal computer from which access to the RB system is performed.

It is also possible to implement the described method, in which the user identifier is generated by the system implementing the method, based on one or more identifiers of a similar purpose coming from the banking system. The generation of such a unique identifier can be performed in any well-known manner, for example, by hashing a character string obtained by concatenating identifiers received from the banking system.

As a rule, the user ID is somehow encrypted on the side of the bank; its decryption is not required for the implementation of the described method, and the specific way in which it was generated is also immaterial. It is sufficient that this identifier be unique and stably reproducible during each session of access to the RBS system under the credentials (login and password) of a particular account.

In the following, for simplicity, we will denote the user identifier as USER(i), where a different value of i indicates different users.

The ID of the current user interface window is at least one combination of characters that uniquely matches the user interface window currently open by the user.

This window may be a page of an Internet site, and then the identifier may be, for example, a hash from the URL of this page or from its title (a sequence of characters placed under the <title> tag). In another case, this window may be an interface element of a program running on a mobile device or at an ATM, and then the identifier may be a hash of the name of this interface element or its other designation used in the program.

For the purposes of implementing the described method, it is sufficient that this identifier be unique within the given RBS system and stably reproducible upon each successful access to a specific interface window.

It is also possible to implement the described method, in which the identifier of the current window is generated by the system implementing the method, based on one or more window identifiers received from the banking system. The generation of such a unique identifier can be performed by any well-known method, for example, by hashing a character string obtained by concatenating identifiers received from the banking system.

In a variant of the implementation of the method, which implies the presence of one complex user interface window with several work areas, the input focus can act as the "identifier of the current window",

https://ru.wikipedia.org/w/index.php?title=%D0%A4%D0%BE%D0%BA%D1%83%D1%81%D0%BF%D0%BE%D0%BB %D1%8C%D0%B7%D0%BE%D0%B2%D0%B0%Dl%82%D0%B5%D0%BB%D1%8C%D1%81%D0%BA%D0%B8%D0 %B9%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D1%84%D0%B3%D0%B9%D1%81)&stable=1, i.e. some sequence of service characters generated by the program that owns the complex window and carrying information about which of the numerous elements of the program interface (buttons, pop-up lists, radio buttons, text entry windows, etc.) is currently active and ready for accepting user commands.

The transformation of such a sequence into a uniform place identifier in the RBS user interface can be performed, for example, by taking a hash function from this character sequence itself or by any other well-known method.

Below, the description will denote the identifier of the current window as PAGE(j), where a different value of j indicates different user interface windows or different user interface elements in a single-window version.

To implement the described method in the form of a distributed software and hardware system located on various Internet servers and serving simultaneously many RBS channels belonging to different banks, it will also be necessary to collect and process an additional identifier indicating which bank system received certain USER identifiers ( i); PAGE(j).

This additional identifier - let's designate it as BANK(q) - is static, it is created once when setting up and starting the RBS system of a given bank. Technically, it can be, for example, an SSL certificate signed by the sites of a given bank, or a separate character string, for example, BANK(q)=SBERBANK, transmitted by the RBS of each bank. The BANK(q) identifier is used for primary sorting of information entering the system and addressing the system's response signals - to the banking anti-fraud department.

Other than these functions, which are obvious and can be implemented in any well-known way, the bank identifier BANK(q) does not perform, therefore, in the further description, this identifier is omitted for simplicity.

Identifiers USER(i); PAGE(j) are always received from the RBS system in pairs and simultaneously, each is accompanied by a timestamp. In fact, some time may elapse between the arrival of the first and second identifiers, due to signal delays in the physical communication lines used by the RBS system, but this time, in the framework of the implementation of the described method, is neglected, considering the time of receipt of identifiers the time of arrival of the last of them.

The term session (S) or, something the same, the session of a given user, within the framework of this description, will be called a data sequence that looks like:

where t ₁ is the timestamp corresponding to the time USER(i) opened the PAGE(1) window, t ₂ is the timestamp corresponding to the time the same user opened the PAGE(2) window, and so on.

It is important that a session is a sequence of pairs of identifiers, in which the user identifier in each pair is the same, i.e. a session is always associated with a specific user and fully describes one session of his work with the RB system.

In the general case, there are a significant number of sessions in the RB system at the same time, since many different users can work with the RB system at the same time. A common practice in banks is to record (save) all sessions and store this information for a significant time (from several months to several years). In one of the possible options for implementing the described method, this array of information can be obtained from the bank and used for preliminary training of the system that implements the method.

Obviously, in a data array covering a sufficiently long time period (for example, a month), along with sessions of legitimate users, there will certainly be sessions of intruders. However, it is known that the frequency of intruder access to the RBS system is extremely low. Legitimate sessions make up the vast majority of sessions saved over a long period of time.

Since the training of the system is essentially the accumulation and statistical analysis of information, the presence of a small number of illegitimate sessions will not affect the quality and results of training.

The system that implements the method sorts the data coming from the RBS system or from the training array of information by USER(i) and forms user sessions. Each pair of USER(i); PAGE(j), as shown in (1), is characterized by an arrival time fixed by storing a timestamp t. Therefore, for each pair, except for the very first pair in each session, the time interval T between the moment of arrival of this pair and the moment of arrival of the previous pair can be calculated. This interval can be calculated as the difference between timestamps (timestamps) t, calculated with a given precision, for example, with an accuracy of 0.01 seconds. For example, the interval between the first and second pairs of identifiers in each session of a given user is calculated as T=t ₂ -t ₁ , and so on.

The calculated intervals are saved for use in further calculations.

The data sequence (1) recorded for one specific user USER(i), after calculating the time intervals T, will take the form:

where T(j) is the time, expressed in seconds and fractions of a second (not necessarily an integer), between the time a given user opened the PAGE(j) window and the time that same user opened the PAGE(j+1) window.

It should be noted that between the windows themselves (for example, web pages) PAGE(j), PAGE(j+1) in the RBS system, there may be no connection at all, nor a logical one, for example, a request expressed in a text message to switch to a certain page, nor physical, i.e. hyperlinks leading from one page to another. Such transitions are formed in bot sessions, i.e. programs imitating one or another activity of RBS users.

Moreover, for the operation of the system that implements this method, it does not matter what exactly the windows of the user interface PAGE(j) and PAGE(j+1) are. They are only needed in the context of the fact that the user logged in as USER(i) first opened a PAGE(j) window, and after some calculated time, a PAGE(j+1) window.

Thus, for each USER(i), a collection of sessions (sessions of a given user) is formed, which has the following form (the numbers of windows and the duration of the intervals between them are chosen arbitrarily in this example):

When the total number of sessions Sk exceeds a predetermined threshold (for example, becomes more than 20), the collection of sessions is analyzed to identify patterns. The term pattern in this case is a repeating sequence of pages, like the sequence PAGE(6) - PAGE(33) - PAGE(21) highlighted in (3). Time intervals T(j) at the stage of pattern detection are not taken into account.

It is important that both all the described and subsequent data transformations are always performed for this particular user. Sessions from collections of different users are never parsed together.

Pattern length, i.e. the exact number of pages opened sequentially will be considered a pattern is chosen in advance. In one possible implementation of the described method, the length of the pattern may be given by an interval. For example, if the pattern length is from 3 to 6, then the pattern PAGE(6) - PAGE(33) - PAGE(21) shown above, which has a length of 3, matches the specified criterion, and the pattern PAGE(5) - PAGE(9) , which has length 2, does not fit. In another implementation, the length of the pattern may be pre-set to a fixed value, such as 4.

In yet another possible implementation, the length of the pattern may be selected automatically depending on the number of patterns detected for a given user. In this variant, the search for patterns starts, for example, at a given length of 3. If and when the number of detected patterns for a given user exceeds the threshold set during system configuration (for example, more than 10 patterns were found), the pattern length is increased by one and the search is repeated, discarding the previously found short patches. Such a cycle is performed until the number of patterns with the maximum possible length less than the threshold value is found.

Such an implementation option is possible, in which a preliminary modification of some of the found patterns is carried out. In the course of modification, some patterns are assigned additional a priori weights associated with the assignment of interface windows that are part of these patterns.

Speaking of the “pattern weight”, in this case we mean a certain predetermined number associated with the given pattern and stored in the system that implements the described method.

For example, patterns containing the PAGE(m) window, which in the RB system interface serves to request the transfer of funds to a bank account or to a wallet of a non-cash payment system, can be assigned an increased weight, for example, 3 times higher than the weight of other patterns.

This weight will be assigned to any patterns containing a PAGE(m) window, regardless of the session of which user USER(i) found these patterns.

Similarly, patterns containing a PAGE(x) window, which in the RBS system interface serves to pay utility bills or taxes, can be assigned a reduced weight, for example, 0.3 of the weight of unmodified patterns.

The specified weight can be used by the system that implements the method, both at the stage of training classifiers described below, and at the stage of user identity control. Such a weight has the meaning of the sensitivity of the system to an event of a certain kind. In this example, the atypical behavior of any user in a high-risk scenario containing a PAGE(m) window would be much more "alarming" to the system than the atypical behavior in a tax-paying scenario, where the probability of an attacker getting hold of someone else's credentials tends to zero.

For each identified pattern, a set of parameters is calculated that characterizes the behavior of a given user when working with the RBS system. All parameters are calculated based on the same collection of sessions.

The first parameter is a vector, which we will call the time vector V. This is a vector whose dimension corresponds to the number of time intervals within the given pattern. For example, for the PAGE(6) - PAGE(33) - PAGE(21) pattern, the time vector will be two-dimensional: V=(Tcp1, Тср2), where Tcp1 is the time between PAGE(6 ) and PAGE(33), and Tcp2 between opening the PAGE(33) and PAGE(21) windows.

To calculate Tcp1 and Tcp2, they take all occurrences of a given pattern found in all sessions of a given user, and calculate these average values using the previously calculated values of the time intervals T(j) between PAGE(6) and PAGE(33) pages, as well as between pages PAGE(33) and PAGE(21).

Time averaging, for example, Tcp1, here can be understood as the arithmetic average of all T1 times for all occurrences of a given pattern in the collection of sessions of a given user. In another implementation, the geometric mean of all occurrences of a given pattern may be calculated. A variant is possible in which the weighted average is calculated, where the number of pages separating the given interval from the initial interval T1 or from the final interval of the given pattern is taken as the weight for each time Ti. The meaning of the last option is that the intervals at the beginning or at the end of the session of a given user have the greatest influence on Ter.

In another possible implementation, the time vector V has dimension 2*n, where n is the number of time intervals within the given pattern. In this case, the time vector stores both the calculated value of the time interval Tav and the variance D. The dispersion here is an indicator of how much the duration of a particular time interval Tav can vary for a given user. A similar vector of dimension 2*n may look like this: V=(Tcp1, D1, Тср2, D2).

The variance of time intervals D1 can be calculated based on the collected collection of sessions of a given user as a variance of the random variable Tcp1, or in any other well-known way. Similarly, the variance D2 can be calculated as the variance of the random variable Tav2.

In addition to the time vector, a frequency can also be calculated for each pattern, showing how often this pattern occurs in the sessions of a given user. The frequency is equal to the ratio of the number of occurrences of a given pattern L to the number of sessions of a given user K.

This parameter can be either less than one if the pattern does not occur in every session, or greater if the pattern occurs several times during each session.

The found patterns and the parameters calculated for each of them are stored for use in further calculations.

Then, for each user, using his data collection, primarily a set of time vectors V, one or more decision rules (classifiers) are trained. The technical implementation of the classifier or classifiers can be any well-known; they can be implemented, for example, as a graph probabilistic model (Random Forest) or as an SVM classifier.

If some patterns were assigned higher and/or lower weights when compiling a collection of patterns, associated with the assignment of one or more windows of the RB system interface included in the pattern, then these weights can be taken into account when choosing or training a classifier or classifiers in such a way that the corresponding patterns had a proportionally greater or lesser influence on the final decision. Likewise, frequency can also be used as a boost or step down factor at this stage.

In one of the possible implementations of the described method, one classifier can be trained on the calculated values of the averaged time intervals, and the second - on the calculated values of the dispersion of the time intervals.

All of the above actions, starting with saving pairs of identifiers {USER(i), PAGE(j)} and their corresponding timestamps t, and ending with training classifiers for a given user, can be performed online, directly during the operation of the RBS service.

In another possible implementation, the system implementing the described method can be pre-trained offline. In this embodiment, the system receives for analysis a data array previously saved by the RBS service, performs, as described above, data analysis, trains classifiers for all users whose identifiers were in the received data array. When the analysis is completed and the classifiers are trained, the system that implements this method is transferred to online mode and then functions in conjunction with the RBS service.

Applying a trained classifier or classifiers might look like this. The system that implements the method sorts the data coming from the RBS service by USER(i) and forms user sessions (work sessions of specific users). From the very beginning of the session, as soon as the very first USER(i) is received, the classifier or classifiers trained on the collection of patterns of the user corresponding to this USER(i) is selected and launched. The input of the classifier or classifiers is all data of the current session of the given user. Thus, the system that implements the described method analyzes the user's identity directly in the course of this user's work with the RBS service.

The decision of the classifier or classifiers is a numerical estimate of the probability that, under the given USER(i), the entry into the RBS system was made by the user on whose collection of patterns the classifier or classifiers were trained. This solution is constantly updated during a given user's session, i.e. the decision of the classifier or classifiers is reviewed upon receipt of each next pair {USER(i), PAGE(j)}.

The solutions of each classifier are sent to the bank's anti-fraud system, where they can be used to generate alerts that have the meaning of a warning about the atypical behavior of a particular user USER(i), or other signals of a similar purpose.

In those embodiments of the described method that do not imply the presence of an anti-fraud system (for example, an online store, a web service for teamwork, a multi-user computer game), the solutions of trained classifiers can enter the access control system used by this service or site, to the working panel of the service moderator or information security specialist, or used by the system software to perform actions that prevent illegal access to the system. For example, to initiate a direct connection with a given user and request additional identifying information (security question, phone number, and so on).

In one of the possible implementations of this method, such a signal can be generated under the condition that there are no typical patterns for a predetermined number of pages opened by the user, i.e. when a given user behaves atypically long enough.

It is also possible to implement the system, in which the condition for generating an alarm signal is the absence of at least one pattern having the highest frequency of all patterns of a given user for a predetermined time.

The described method can be implemented in any variant of the authorized remote access service, which implies the presence of several user interface windows or the presence of several work areas in one complex user interface window and various possible ways to switch between them (both windows and zones).

On FIG. 2 will now present a general diagram of a computer device (200) that provides the data processing necessary to implement the claimed solution.

In General, the device (200) contains components such as; one or more processors (201), at least one memory (202), data storage means (203), input/output interfaces (204), I/O means (205), networking means (206).

The processor (201) of the device performs the basic computing operations necessary for the operation of the device (200) or the functionality of one or more of its components. The processor (201) executes the necessary machine-readable instructions contained in the main memory (202).

The memory (202) is typically in the form of RAM and contains the necessary software logic to provide the desired functionality.

The data storage means (203) can be in the form of HDD, SSD disks, raid array, network storage, flash memory, optical information storage devices (CD, DVD, MD, Blue-Ray disks), etc. The means (203) allows long-term storage of various types of information, for example, the above-mentioned files with user data sets, a database containing records of time intervals measured for each user, user identifiers, etc.

Interfaces (204) are standard means for connecting and working with a computer device, such as USB, RS232, RJ45, LPT, COM, HDMI, PS/2, Lightning, Fire Wire, etc.

The choice of interfaces (204) depends on the specific design of the device (200), which can be a personal computer, mainframe, server cluster, thin client, smartphone, laptop, part of a banking terminal, ATM, etc.

The data I/O means (205) may be a mouse, a joystick, a display (touchscreen), a projector, a touchpad, a keyboard, a trackball, a light pen, speakers, a microphone, and the like.

Means of network interaction (206) are selected from a device that provides network data reception and transmission, for example, an Ethernet card, WLAN/Wi-Fi module, Bluetooth module, BLE module, NFC module, IrDa, RFID module, GSM modem, etc. With the help of means (206) the organization of data exchange over a wired or wireless data transmission channel, for example, WAN, PAN, LAN (LAN), Intranet, Internet, WLAN, WMAN or GSM, is provided.

The components of the device (200) are connected via a common data bus (210).

In these application materials, a preferred disclosure of the implementation of the claimed technical solution was presented, which should not be used as limiting other, private embodiments of its implementation, which do not go beyond the scope of the requested legal protection and are obvious to specialists in the relevant field of technology.

Claims (29)

1. A method for identifying a user by a sequence of opened windows of the user interface, which consists in performing the steps at which, using a computing device: registering user credentials in the system; assigning a user ID corresponding to the credentials; - each window of the user interface opened by the user is assigned an identifier; - throughout the entire session of the identified user, the sequence of opened windows of the user interface is fixed, while: • store the identifier of the window that is currently open by the user, and the opening time of this window; • at each transition to a new window of the user interface, the identifier of this window and the time when it was opened are saved; - accumulate a predetermined number of sessions of this user; - analyze the accumulated data, namely, identify repeating sequences of visited windows of the user interface (patterns); - patterns with the maximum possible length are selected from the identified patterns, and their number should be no more and no less than predetermined values; - for each selected pattern, a set of parameters is calculated, which includes the time elapsed between transitions of the given user from window to window of the user interface, and averaged over all sessions of the given user in which this pattern occurs, and the variance calculated as the variance of a random variable, for the time intervals between transitions of a given user from window to window of the user interface; - save a given number of patterns of the given user and on the basis of the parameter sets calculated for the selected patterns, at least one classifier is trained to identify the given user by the sequence of visited pages; - the trained at least one classifier is used for subsequent confirmation of the identity of the user, during the sessions of which at least one classifier was trained. 2. The method according to claim 1, characterized in that the user interface windows are web pages. 3. The method according to claim 1, characterized in that patterns containing predetermined user interface windows can be assigned a priori weights, which weights are taken into account when selecting or training at least one classifier so that the corresponding patterns render proportionally more or less influence on the final decision of at least one classifier. 4. The method according to claim 1, characterized in that the set of parameters calculated for each pattern additionally includes the frequency of this pattern in sessions of the given user. 5. The method according to claim 4, characterized in that the frequency is taken into account when choosing or training at least one classifier so that patterns with a higher frequency have a proportionally greater influence on the final decision of at least one classifier. 6. The method according to claim 1, characterized in that the classifier is taught by machine learning. 7. The method according to claim 6, characterized in that the classifier can be implemented as a graph probabilistic model or as an SVM classifier. 8. A user identification system based on the sequence of visited user interface windows, comprising: - a block for registering user credentials in the system; - system clock, made with the possibility of fixing the time - identification block of the current window of the user interface; - long-term memory configured to store the database; - a computing device configured to perform the method according to any one of paragraphs. 1-7. 9. The system according to claim 8, characterized in that the user identification system based on the sequence of user interface windows visited is an integral part of the remote banking system. 10. The system according to claim 8, characterized in that the user identification system based on the sequence of user interface windows visited is an integral part of the website, which implies user authorization. 11. The system according to claim 8, characterized in that the user identification system based on the sequence of visited user interface windows is an integral part of a multiplayer computer game that implies user authorization. 12. The system according to claim 8, characterized in that the user identification system by the sequence of visited user interface windows is an integral part of the software and hardware complex for collaboration, which implies user authorization.

Images